Skip to main content
Every endpoint except GET /api/v1/models requires an API key. The key is read from two possible headers — pick one.

Key format

  • Always starts with vg_, followed by 32 hexadecimal characters.
  • Bearer is case-insensitive (bearer vg_... is accepted too).
  • The vg_ prefix is mandatory. A key without the prefix is rejected even if the rest is correct.
  • Keys are created on the dashboard API key page; the raw key is shown only once.

Authentication failures

Every authentication failure uses the same body shape: { "error": "..." }. There is no numeric code — use the HTTP status to tell them apart.

Security

Send it over HTTPS only. A key must never travel through an http:// URL or be pasted into a query string.
Name each key after its environment. staging, prod-cron, lokal-andi — so that revoking one key does not take another system down.
Do not use a dashboard key in an end user’s browser. Every API request deducts credits from the key owner’s account. For a multi-user product, keep the key on your server and allow access only from there.
Do not store keys in mobile apps or frontend bundles that can be unpacked. If a key leaked, revoke it and create a new one — rotation is the only way to revoke.

Endpoints that do not need a key

GET /api/v1/models may be called without authentication because it only contains the public catalog. If your application shows prices or balances, still send a key. Continue to Base URL.